First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing Access Control

funkornaut

Summary

Critical setPassword Function Lacks Access Control

Vulnerability Details

Per the developer's notes, the setPassword function is intended to be callable only by the owner. However, this function currently lacks any access control checks, making it callable by anyone.

Impact

Anyone can change the password.

Tools Used

Manual review

Recommendations

  1. Create an onlyOwner modifier and use it on functions that should be callable only by the owner.

modifier onlyOwner() {
if (owner() != _msgSender()) {
revert PasswordStore__NotOwner();
}
_;
}

  1. Consider utilizing OpenZeppelin's Ownable contract, which already provides the onlyOwner modifier.

  2. Use the same logic in the getPassword function within the setPassword function.

if (msg.sender != s_owner) {
revert PasswordStore__NotOwner();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.